CSIDB logo
Incident

City of Green River

Incident posture

Attack window
Jun 2025
Location
United States of America
Status
Unknown
CIA posture
Available to members
Updated
2026-06-19 00:16

Linked entities

Victim
City of Green River
Threat actors
0 actors
Sources
1 source

Timeline

Occurred
Jun 2025
Discovered
Pending
Disclosed
Pending
Resolved
Pending

Summary

The City of Green River experienced a ransomware attack that crippled its computer systems. Finance director Chris Meats confirmed the incident and said there is no evidence of data being accessed or taken. IT director David Halter noted that the Sweetwater Combined Communications Joint Powers Board is providing a temporary, isolated network to the police department for report writing. Other local agencies, including the Joint Powers Water Board, school district, sheriff’s office and neighboring city, reported no similar impacts.

Motives

Detailed motive labels are available to members.

1 motive

TTPs

Detailed technique labels are available to members.

1 technique

Description

On June 1, 2025, the City of Green River announced that its computer systems had been impacted by a ransomware attack. Chris Meats, the city’s finance director, confirmed the ransomware incident to SweetwaterNOW. He stated that the attack had crippled the city’s computer systems. Ransomware is described as malicious software that blocks access to a system until a payment is made.

Meats said there was no evidence of a data breach or data exfiltration at that time. He noted that the city had not detected any unauthorized access to or theft of data. The attack appeared to be limited to the City of Green River, with no similar incidents reported by neighboring agencies. Those agencies confirmed to SweetwaterNOW that they had not experienced comparable ransomware effects.

To maintain police operations, the Sweetwater Combined Communications Joint Powers Board’s dispatch center provided a temporary network and computers to the Green River Police Department. David Halter, the IT director for that board, said the temporary network was isolated from the city’s compromised network. The temporary resources were intended to help officers continue filing reports despite the city’s system outage. No further details about the ransomware variant, ransom demand, or restoration timeline were disclosed by city officials.

Sources

Sources available to members: 1 source.

CSIDB